Security researcher discovers massive data leak by registering misconfigured "noreply" domains

A security researcher has stumbled onto a sprawling vulnerability in how organizations configure their email systems: by purchasing two commonly-misused domains, he's now receiving the private data, corporate credentials, and sensitive information that companies believed they were discarding.

The accidental honeypot#

Cory Solovewicz registered noreply.us in 2020 and noreply.net in 2024 with modest intentions. His plan was to use them as catch-all email addresses to filter unwanted messages and protect his privacy. Instead, he's become the unintended recipient of corporate secrets.

Since December 2024 alone, his noreply.net address has accumulated nearly 402,000 messages—roughly 700 per day on average. These aren't ordinary spam. Municipal governments have sent him injury reports, schools have transmitted account setup credentials, businesses have forwarded test platform logins, and pizza chains have emailed order confirmations for complete strangers.

"I created an accidental honeypot," Solovewicz told WIRED. "I had no idea it was going to turn into this."

Why companies are sending data to these addresses#

The misconfiguration stems from a widespread but misguided assumption. Many organizations default to sending emails to addresses like [companyname]@noreply.net or similar variations, operating under the false belief that these domains are non-functional dead-ends where messages disappear without being monitored.

Complicating matters further, some systems automatically reroute emails to placeholder domains when employees leave a company or when customer accounts are deleted, creating additional vectors for sensitive data to leak into the wild.

A fortunate catch#

What began as a personal privacy project has evolved into a significant security awareness campaign. Solovewicz recently presented his findings at Defcon, the major security conference, underscoring the systematic nature of the problem.

He views the situation with cautious optimism: while his discovery exposes alarming lapses in how companies protect information, he emphasizes that it's preferable the misconfigured domains fell into the hands of a well-intentioned researcher rather than criminal actors or state-sponsored hackers who might weaponize the data.